Comments (8)
@DennisDobslaf yes I know, but imagine situation when RouteGuard detects that permission is not granted then fires MvcEvent::EVENT_DISPATCH_ERROR
and this does not stop dispatch process(does not return response because of some buggy listener) then MvcEvent::EVENT_ROUTE
will call next listener if $event->stopPropagation(true);
not set and route will be found allowing user to access this protected route.
I am not 100% sure this is possible, but well if permission is not granted then must stop propagation at least or return default Response
with error to prevent further processing MvcEvent::EVENT_ROUTE
event. Unless we believe that
$event->setName(MvcEvent::EVENT_DISPATCH_ERROR);
$eventManager->triggerEvent($event);
will 100% stop dispatch process and will return error message. But Imagine situation when we don't have any listeners for MvcEvent::EVENT_DISPATCH_ERROR
then we have a problem.
Ok this is just a corner case situation and I am not even sure this is possible, but anyway this should be tested and fixed.
from zfc-rbac.
hmm yep this whole check is not necessary could be just:
$event->setName(MvcEvent::EVENT_DISPATCH_ERROR);
$eventManager->triggerEvent($event);
because this would work with EventManager v2 and v3
from zfc-rbac.
L71 should be
$event->stopPropagation(false);
then.
Because v2 Eventmanager doesn't set this in triggerEvent but in trigger (which wouldn't be called anymore).
Added: v3 Eventmanager sets stopPropagation to false in triggerListeners which v2 doesn't.
That's a weired switch... from v2 to v3
from zfc-rbac.
I think this by default is false
but maybe I am wrong.
from zfc-rbac.
woops missed the point :D hmm just a quick look but this $event->stopPropagation(true);
also not required haven't tested but why we need to stop? again missing something? :)
from zfc-rbac.
Off course, you are right. false is the default value.
So, changing the lines like your comment and deleting stopPropagation(true) works (for me) with v2. Currently i'm not able to validate this with v3.
This is the complete AbstractGuard::onResult
/**
* @private
* @param MvcEvent $event
* @return void
*/
public function onResult(MvcEvent $event)
{
if ($this->isGranted($event)) {
return;
}
$event->setError(self::GUARD_UNAUTHORIZED);
$event->setParam('exception', new Exception\UnauthorizedException(
'You are not authorized to access this resource',
403
));
$application = $event->getApplication();
$eventManager = $application->getEventManager();
$event->setName(MvcEvent::EVENT_DISPATCH_ERROR);
$eventManager->triggerEvent($event);
}
Added: Guess you can't be sure what happend to $event previously
from zfc-rbac.
guess should work, even if not this looks like a bug and should be like this then:
$event->setName(MvcEvent::EVENT_DISPATCH_ERROR);
$eventManager->triggerEvent($event);
$event->stopPropagation(true);
to be really sure MvcEvent::EVENT_ROUTE
is really stopped but can't imagine situation when we have MvcEvent::EVENT_DISPATCH_ERROR
and continue with dispatch process.
from zfc-rbac.
stopPropagation should only be changed in the called listeners i guess. And be the default previously.
from zfc-rbac.
Related Issues (20)
- Tag stable version for ZF3 compat HOT 6
- Looking for a new maintainer(s) HOT 5
- Missing use statement in ZfcRbac\Initializer\AuthorizationServiceInitializer HOT 1
- RedirectStrategy + zf3 HOT 8
- Future HOT 23
- Very strange session regeneration issue when using ZfcUser with ZfcRbac HOT 3
- Fllow the cookbook I get a problem not fund the authorizationservice HOT 3
- Unable to resolve service "Zend\Authentication\AuthenticationService
- why i always get error flow the cookbook? i will show what happend with my application HOT 4
- Cannot get a name and parameters for RoleProviderPluginManager HOT 2
- a guard priority question HOT 1
- Is there Mechanism of a cache? HOT 1
- Problem with doctrine update
- What is the plan of 3.0 release? HOT 7
- Maybe we could have PermissionProvider?
- HierarchicalRoleInterface problem HOT 1
- Config for version 3.0 needs some fixing or explaining HOT 9
- Migrate to Laminas HOT 7
- Is there a migration to Laminas either on-going or planned?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from zfc-rbac.